BRUSSELS, 18th November, 2024 (WAM)-- The European Council approved a declaration by the EU and its member states on a common understanding of the application of international law to cyberspace. The declaration signals that international law remains fit for purpose in this digital domain and reiterates that states must abide by certain rules and obligations when conducting activities in cyberspace.
The declaration acknowledges that malicious behaviour in cyberspace, including ransomware, is increasing in scale, severity, sophistication, and impact, presenting a major challenge and threat to the functioning of European societies, economies, and way of life. However, cyberspace is not a lawless domain.
The respect for and adherence to the UN framework of responsible state behaviour in cyberspace remain essential to maintaining international peace, security, and stability. The EU and its member states therefore reaffirm their full commitment to the implementation of the UN framework of responsible state behaviour in cyberspace, adopted by consensus and repeated on several instances by the UN General Assembly (UNGA), which affirms inter alia that international law, particularly the UN Charter, international human rights law, and international humanitarian law, fully applies to cyberspace.
The EU and its member states will continue working with international partners to establish one single, permanent, inclusive, regular, and action-oriented UN mechanism to implement and advance responsible state behaviour in cyberspace: the Programme of Action.
With this declaration, the EU and its member states show that it is possible to reach a common understanding on a set of fundamental principles and rules of international law applicable to cyberspace. A better global common understanding of how international law applies to cyberspace contributes to enhanced global cyber resilience and further transparency and predictability of, and accountability for, states’ conduct in cyberspace. In that vein, the EU and its member states continue to support third countries through training and capacity building on the implementation of the UN framework of responsible state behaviour in cyberspace, including on how to develop a national, regional, or international position on the application of international law to cyberspace.